<html>
<head><meta charset="utf-8"><title>ucg#203 · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html">ucg#203</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="176076283"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076283" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076283">(Sep 19 2019 at 07:44)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I was wondering if we need to use the term "Undefined Behavior" in the spec at all</p>



<a name="176076309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076309">(Sep 19 2019 at 07:45)</a>:</h4>
<p>One thing that is becoming clearer to me is that it is a bad name, it means different things to different people, and the name is not really that self-describing. What does undefined mean? Not defined? A lot of things are not defined, out of scope, unspecified, etc.</p>



<a name="176076374"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076374" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076374">(Sep 19 2019 at 07:46)</a>:</h4>
<p>One thing I'm tending to wish more and more is that we would, instead, define what "guaranteed behavior" is</p>



<a name="176076413"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076413" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076413">(Sep 19 2019 at 07:47)</a>:</h4>
<p>Or something like that, that talks about: if you stick to the contract of the rust abstract machine, the compiler / impl guarantees that your program runs on real hardware according to the abstract machine rules.</p>



<a name="176076478"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076478" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076478">(Sep 19 2019 at 07:48)</a>:</h4>
<p>And then talking about implementation-defined/unspecified might become: the implementation must guarantee what the behavior is, and for implementation-defined it must say what those guarantees are</p>



<a name="176076490"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076490" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076490">(Sep 19 2019 at 07:49)</a>:</h4>
<p>The guarantee then cannot be "there are no guarantees", since the abstract machines requires the implementation to have to guarantee some concrete behavior</p>



<a name="176076494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076494">(Sep 19 2019 at 07:49)</a>:</h4>
<p>After going through all that, then we come to "behavior for which the abstract machine does not provide any guarantees"</p>



<a name="176076562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076562">(Sep 19 2019 at 07:51)</a>:</h4>
<p>The implementation might provide some, the hardware might provide some, but that doesn't matter for the abstract machine - and something like miri can just error</p>



<a name="176076569"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076569" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076569">(Sep 19 2019 at 07:51)</a>:</h4>
<p>The abstract machine can do anything, like optimizing away code that reaches there.</p>



<a name="176076573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076573">(Sep 19 2019 at 07:51)</a>:</h4>
<p>Users cannot do negative reasoning about this type of behavior.</p>



<a name="176076632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076632">(Sep 19 2019 at 07:52)</a>:</h4>
<p>To allow users to assume that something cannot happen, we would need to provide them with an explicit guarantee that justifies that, e.g., references are guaranteed to never be null</p>



<a name="176076652"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076652" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076652">(Sep 19 2019 at 07:53)</a>:</h4>
<p>I think doing it this way might make the document much easier to understand</p>



<a name="176076720"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076720" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076720">(Sep 19 2019 at 07:54)</a>:</h4>
<p>instead of writing "if you do this, the behavior is undefined", "exhibits undefined behavior", "is undefined behavior" - we'd just more plainly write "The abstract machine does not guarantee anything about programs that do X".</p>



<a name="176076781"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076781" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076781">(Sep 19 2019 at 07:56)</a>:</h4>
<p>Or just like you propose, "Doing X is an error in the abstract machine"</p>



<a name="176076830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176076830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176076830">(Sep 19 2019 at 07:56)</a>:</h4>
<p>That would also link nicely with <code>miri</code>, where the goal is for UB to just be raised as an error.</p>



<a name="176159603"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/176159603" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#176159603">(Sep 20 2019 at 02:25)</a>:</h4>
<p>Absolutely, we should focus more on saying what's guaranteed. That's both what people writing unsafe code want to know for sure, and also the kind of thing an eventual spec will have to specify.</p>



<a name="177710217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/177710217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#177710217">(Oct 09 2019 at 12:52)</a>:</h4>
<blockquote>
<p>Or just like you propose, "Doing X is an error in the abstract machine"</p>
</blockquote>
<p>agreed, I think positive statements are better. that said, we likely do still need to relate to C-style terminology, just because many people use it and think they know what it means (many of those are wrong, but well).</p>



<a name="177710272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/177710272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#177710272">(Oct 09 2019 at 12:53)</a>:</h4>
<p>but the roead for that could be to explain UB in terms of this: "UB is an error condition in the abstract machine; the Rust compiler assumes that such errors are never reached by the program it compiles"</p>



<a name="177710362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/177710362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#177710362">(Oct 09 2019 at 12:54)</a>:</h4>
<p>and this is also in line with me saying "it is a spec bug to leave out a case": when the spec does a case distinction, it should explicitly list all cases that are abstract machine errors; there is no "implicit" fall-back to that -- there is no "implicit UB".</p>



<a name="177780581"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg%23203/near/177780581" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ucg.23203.html#177780581">(Oct 10 2019 at 05:28)</a>:</h4>
<p>Makes sense</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>